Ready Ecommerce
Approved changes feed: RSS · Atom
cpe:2.3:a:razinsoft:ready_ecommerce:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Razinsoft (cab93fb1-ae6f-5ef9-a8d6-e314815e3db4) |
|---|---|
| Product | Ready Ecommerce (e6e722a8-8b99-5aa2-8c5c-6fec7aa610a8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-63106 |
vulnerable | 2026-09-16 04:32:49.818155 |
ReadyEcommerce < 4.5.2 Unauthenticated SQL Injection via ProductController.php
CRITICAL (9.8)
ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform time-based blind SQL injection through the unsanitized rating parameter to extract the full database contents, including user credentials and administrator password hashes, with potential additional file system access due to the database connection running as root.
Published: 2026-08-10T13:42:31.849Z
Updated: 2026-08-10T21:11:17.703Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-63105 |
vulnerable | 2026-09-16 04:32:49.550766 |
ReadyEcommerce < 4.5.2 Stored XSS via Chat and Support Ticket Systems
MEDIUM (5.4)
ReadyEcommerce before 4.5.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated customers to inject malicious HTML payloads through the chat and support ticket messaging systems by exploiting unsanitized rendering via the v-html directive in Messages.vue, RightChatSidebar.vue, SupportTicketMessages.vue, and SupportTicketDetails.vue. Attackers can submit crafted message content that executes arbitrary JavaScript in the browser of any shop owner or administrator who views the message, enabling session cookie theft and account takeover.
Published: 2026-08-10T13:39:15.205Z
Updated: 2026-08-10T18:10:29.663Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.